A preliminary investigation (T326759) has found that the Collection extension may be affected by IP Masking
Description
Details
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Treat temporary users like anonymous users | mediawiki/extensions/Collection | master | +1 -1 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Restricted Task | |||||
| Resolved | kostajh | T294511 2021 Security Team wikireplicas audit | |||
| Declined | None | T284948 Raw IPs of logged-out users disclosed in wiki-replicas | |||
| Resolved | Niharika | T324492 Temporary accounts - MVP | |||
| Resolved | Madalina | T326816 [Epic] Update features for temporary accounts | |||
| Resolved | Amdrel | T326936 Prepare Collection extension for IP Masking |
Event Timeline
Change #1059172 had a related patch set uploaded (by Amdrel; author: Amdrel):
[mediawiki/extensions/Collection@master] Treat temporary users like anonymous users
I've attached a patch that adjusts the behavior of the '$wgCollectionPortletForLoggedInUsersOnly' variable to treat temporary accounts just like anonymous accounts. Collections already cannot be saved even when enabled for all users, just like anonymous users, so I didn't need to update that part.
Thanks @Amdrel .
If you have a moment to add testing steps again, it'd be appreciated!
Testing Instructions
The following configuration was used for this test.
$wgCollectionPortletForLoggedInUsersOnly = true; $wgGroupPermissions['user']['collectionsaveascommunitypage'] = true; $wgGroupPermissions['user']['collectionsaveasuserpage'] = true;
Steps
Page Tools
- Enable temporary accounts and make an edit on the wiki to get an account.
- Confirm that the 'Print/export' menu in the tools section does not render.
- Confirm that toggling $wgCollectionPortletForLoggedInUsersOnly to false allows the section render for temporary accounts.
Book Creator
- Navigate to /wiki/Special:Book with the temporary account.
- Confirm that the 'Save and share your book' section does not render.
- Log into any named user account (e.g. Admin) and navigate to /wiki/Special:Book again.
- Confirm that the 'Save and share your book' section appears for named accounts.
Change #1059172 merged by jenkins-bot:
[mediawiki/extensions/Collection@master] Treat temporary users like anonymous users
I have verified the new code has been implemented and is functioning, and displaying as expected (Per the Testing Instructions)...
Thank you for the Testing Instructions @Amdrel.